Categories: Trojan

TrojanDownloader:Win32/Renos.DZ malicious file

The TrojanDownloader:Win32/Renos.DZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Renos.DZ virus can do?

Sample contains Overlay data
HTTPS urls from behavior.
Reads data out of its own binary image
Authenticode signature is invalid
Checks for the presence of known devices from debuggers and forensic tools
Checks for the presence of known devices from debuggers and forensic tools
Attempts to modify proxy settings
Creates a copy of itself
Touches a file containing cookies, possibly for information gathering

How to determine TrojanDownloader:Win32/Renos.DZ?


File Info:
name: 587297A5DF9F1E06C737.mlwpath: /opt/CAPEv2/storage/binaries/1a844824bdde7ceea683982afb97c18965f9fbba4b90f00f261e612ab38789b2crc32: C6E4FCEFmd5: 587297a5df9f1e06c737530a36ac2785sha1: 59ba94dac4ce586fab407ba4ccca2e9e17b82ed3sha256: 1a844824bdde7ceea683982afb97c18965f9fbba4b90f00f261e612ab38789b2sha512: 2a8ff0d2712466d4f39af8963ab8721724c79be7c30e246c548aa72d8806e58deb5b4d337d8d86dc2cd32e53c8afccb5c9443d66e125a987940164c02340a83cssdeep: 3072:2x9hroGn1XFLv5pBZrBi0n2Q2lVOt7KsLIw0poIFB8tPPmID7oNVszAn:2xzHdvzBZrBSQ2UJLQpoCBWmID7oNpntype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E4140757C2D5ED36DA4520B8CFEE82B7643256B01E49238367ECED2D9861CD710B287Bsha3_384: 8cec73b087f2102389ad8a418a1be1ebfb1e9d235674b364401709897fa27994480e466a08f50fb5d8d53efbd3de3357ep_bytes: 558bec6aff68e8a34200687081420064timestamp: 2008-11-19 09:47:11
Version Info:
0: [No Data]

TrojanDownloader:Win32/Renos.DZ also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agent.lgAF
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Heur.mmX@YcYAL5j
ClamAV	Win.Trojan.Agent-495225
FireEye	Generic.mg.587297a5df9f1e06
McAfee	Downloader-FIS!587297A5DF9F
Cylance	unsafe
Zillya	Trojan.FraudPack.Win32.656
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan-Downloader ( 0055e3da1 )
K7GW	Trojan-Downloader ( 0055e3da1 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	AI:Packer.0033CB9F1B
VirIT	Trojan.Win32.Generic.EDR
Cyren	W32/Downloader.STHY-2367
Symantec	Trojan.Gen.2
ESET-NOD32	Win32/TrojanDownloader.FakeAlert.RJ
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Trojan.Heur.mmX@YcYAL5j
NANO-Antivirus	Trojan.Win32.FraudPack.qmfz
Avast	Win32:DropperX-gen [Drp]
Tencent	Malware.Win32.Gencirc.10b38016
TACHYON	Trojan/W32.FraudPack.204804
Emsisoft	Gen:Trojan.Heur.mmX@YcYAL5j (B)
F-Secure	Trojan.TR/Dldr.Agent.ozm
DrWeb	Trojan.DownLoad.15092
VIPRE	Gen:Trojan.Heur.mmX@YcYAL5j
TrendMicro	TROJ_WEVARM.SM
McAfee-GW-Edition	BehavesLike.Win32.Generic.dh
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
Ikarus	Trojan-Dropper
GData	Gen:Trojan.Heur.mmX@YcYAL5j
Jiangmin	TrojanDownloader.Agent.amrn
Avira	TR/Dldr.Agent.ozm
Antiy-AVL	Trojan[Downloader]/Win32.FraudLoad
Xcitium	TrojWare.Win32.Downloader.Agent.~ADM@p4dt
Arcabit	Trojan.Heur.EF1DB6
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	TrojanDownloader:Win32/Renos.DZ
Google	Detected
AhnLab-V3	Trojan/Win32.FakeAV.R2641
VBA32	BScope.Trojan.Download
ALYac	Gen:Trojan.Heur.mmX@YcYAL5j
MAX	malware (ai score=82)
Malwarebytes	Malware.AI.42811840
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_WEVARM.SM
Rising	Trojan.Win32.Undef.tao (CLASSIC)
Yandex	Trojan.Renos.Gen.15
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.1739280.susgen
Fortinet	W32/FakeAlert.UX!tr.dldr
AVG	Win32:DropperX-gen [Drp]
Cybereason	malicious.ac4ce5
DeepInstinct	MALICIOUS